suricata: ensure event.kind is correctly set for pipeline errors (#6625)

elastic · Jun 20, 2023 · bb70c15 · bb70c15
1 parent 2ca9c42
commit bb70c15
Show file tree

Hide file tree

Showing 7 changed files with 22 additions and 2 deletions.
diff --git a/packages/suricata/changelog.yml b/packages/suricata/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.9.0"
+  changes:
+    - description: Ensure event.kind is correctly set for pipeline errors.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6625
 - version: "2.8.0"
   changes:
     - description: Update package to ECS 8.8.0.

diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/default.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/default.yml
@@ -680,5 +680,8 @@ processors:
       ignore_missing: true
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'
diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/dns-answer-v1.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/dns-answer-v1.yml
@@ -35,5 +35,8 @@ processors:
         }
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'
diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/dns-answer-v2.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/dns-answer-v2.yml
@@ -38,5 +38,8 @@ processors:
         }
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'
diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/dns.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/dns.yml
@@ -89,5 +89,8 @@ processors:
       ignore_missing: true
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
       value: '{{{ _ingest.on_failure_message }}}'
diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/tls.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/tls.yml
@@ -185,5 +185,8 @@ processors:
       ignore_missing: true
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
-      value: '{{{ _ingest.on_failure_message }}}'
+      value: '{{{ _ingest.on_failure_message }}}'
diff --git a/packages/suricata/manifest.yml b/packages/suricata/manifest.yml
@@ -1,6 +1,6 @@
 name: suricata
 title: Suricata
-version: "2.8.0"
+version: "2.9.0"
 release: ga
 description: Collect logs from Suricata with Elastic Agent.
 type: integration